Fraud prevention API (beta)
Stop fraud and account abuse at scale
Score every sign-up, login and payment with IP, email, phone, device and behavior signals, and act before the damage is done. Real users barely notice.
Up to 2,000 free checks every month. No card needed.
curl -X POST https://api.openshield.dev/fraud/v1/decide \
-H "Authorization: Bearer $OPENSHIELD_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "account.created", "actor_id": "u_4821",
"email": "farm-0193@example.com", "ip": "203.0.113.50",
"user_agent": "python-requests/2.32", "country": "BE"}'{
"decision": "block",
"reasons": [
{ "rule": "core_blocked_ip", "workflow": "core_blocklists", "mode": "act",
"reason": "The request comes from an address blocked by an administrator" }
],
"shadow": { "reasons": [
{ "rule": "signup_http_client", "workflow": "trial_signup", "score": 40, "mode": "shadow",
"reason": "A sign-up sent by an HTTP library, not by a browser or an app" }
] },
"case_id": 42
}The stack
Everything you need to stop fraud and abuse
One API and one dashboard, instead of a patchwork of point products.
IP intelligence
Assess address risk. Detect VPNs, Tor exits, datacenter and hosting traffic.
Email intelligence
Check email quality. Detect disposable domains and addresses that look machine-made.
Phone intelligence
Validate and normalize phone numbers. Detect invalid numbers before they cost you.
Device and browser
Read user agent and device signals. Detect automation, webdrivers and HTTP libraries.
Velocity checks
Count what happens per address, device and account. Catch bursts as they build.
Linked accounts
Connect accounts that share signals. Uncover clusters of multi-accounting.
Cases and lists
Manage trust, block and review lists. Label cases and snooze what you accept.
Reasons and appeals
Explain every decision. Give users a statement of reasons and a way to appeal.
Signed webhooks
Push decisions and case changes to your systems, signed with your own secret.
Your rules
Fraudulent behavior, as defined by you
Start from a rule pack for the abuse you see, then add blocklists and velocity checks of your own. Every pack rule starts in shadow and records what it would do, so you test it on live traffic before it acts.
Fake accounts
Block sign-up farms, trial and promo abuse, and referral gaming.
Account takeovers
Catch account takeover signals at login, and trust earned by paying.
Multi-accounting
Link accounts by shared devices and addresses, then act on the cluster.
Content abuse
Stop phishing pages, malware hosting and link spam at the source.
SMS and email abuse
Stop pumping, inbox probes and sending abuse before the bill arrives.
Transaction abuse
Catch card testing, stolen cards, refund and dispute abuse, and payout collusion.
API abuse
Stop key sharing, resale and compute mining on your free tier.
Your response
Scale threat response with custom flows
Decide what happens to each kind of risk, and let the system take the routine cases off your hands.
Block inline
Answer allow, step up, hold, block or quarantine in the same request, with the reasons.
Review
Send doubtful cases to a queue, and label them to teach your rules what is fraud.
Alert
Get signed webhooks when a decision steps up, holds or blocks, or a case changes.
Rules that turn themselves on
A rule acts alone once it is proven over 30 days on your own labels, or by a review of the accounts it hit. Prefer manual? Switch it.
A safety brake
A sudden wave of blocks is turned into reviews, so a bad rule cannot lock out your users.
For developers
A single API to detect, score, and act
Call decide before a sensitive action. Report what happened with events. Use the same API keys as moderation.
Decide
POST /fraud/v1/decide before a sign-up, a login or a payment. Act on the answer.
Report
POST /fraud/v1/events to tell your instance what happened, singly or in batches.
The same API keys
Add fraud access to a key: the whole API, or decide and events only for a backend that reports.
Yours alone
An instance for each customer
openfraud is open source, and openshield hosts it for you. Your events, accounts and cases never mix with anyone else's, and they stay in Germany.
Pseudonymized from the start
Email addresses, phone numbers, IP addresses and devices are replaced by keyed pseudonyms before any rule sees them. Raw values are not stored.
Kept 30 or 90 days
Events, decisions and cases are deleted after 30 days until your first top-up, 90 days after. Export or erase what is kept about one person with one call.
Hosted in the EU
Each instance runs on a server in Germany, with no contract and no instance fee.
To plan with
Prices and limits
- Decision
- €0.001 per call to /fraud/v1/decide
- Event
- €0.0002 per event reported, each accepted event of a batch
- Free use
- €2.00 each month, shared with moderation checks
- A quiet free instance
- Paused after 30 days without a call, its data kept; the next call or a click resumes it
- Webhooks
- Standard Webhooks, signed with your own secret, sent again for about two days
In the docs
Read how it works
- Fraud prevention Decide and events, the end user's context, prices, webhooks and errors.
- Authentication and keys How to call the API, what a key may do and how to keep it safe.
- Limits and quotas Your limits, how fast you may call the API and what happens at a limit.
- Privacy and data What is stored and what never is, where, and for how long.
More
Other ways in
- For your SaaS Moderate posts, comments, avatars and uploads before they go live.
- Image moderation API Nudity, gore, weapons and more, with a score per category.
- Text moderation API Unsafe text, personal data, spam and scams, with the reasons.
- Pricing Free use each month, then a prepaid balance, priced by what each check uses.
Questions
Before you start
- Will it block my real users on day one?
- No. Only the core acts at first, and the core blocks only what you put in your own blocklists. Every pack rule starts in shadow: the answer says what it would have done, so you can watch it on your own traffic. By default, openshield promotes a rule to act after 30 days when it has proved reliable, and emails you each time. You can switch to promoting rules yourself, or limit automatic promotion to rules that hold or review.
- What if the fraud API is slow or down?
- openfraud's SDKs fail open: on a timeout or an error they retry, then answer allow, so an outage never blocks your users. Give them at least 800 ms.
- Is openfraud open source?
- Yes, under the Apache-2.0 licence. openshield hosts it, keeps each customer's instance apart and bills by the call.
- What does it cost?
- €0.001 a decision and €0.0002 an event, from the same prepaid balance as moderation, with €2.00 of free use each month. Cases, accounts and lists are free.
Create your free account today
€2.00 of free use every month, then pay as you go from a prepaid balance. No card needed, no contract.
Prepaid, in euros, excluding VAT